Today’s briefing covers critical AI sandbox escapes, local LLM runtime vulnerabilities, new Active Directory escalation techniques, and active exploitation of a SonicWall VPN flaw. We also examine the narrowing gap between open and closed models in cyber offense, NVIDIA’s video intelligence platform, Siemens’ AI-driven manufacturing, the expanding passkey attack surface, and a massive aftermarket automotive security failure.
Listen to today’s briefing (podcast)
Key takeaways
ChatGPT’s scheduled-task sandbox has internet access, enabling a prompt-injection chain that could exfiltrate cross-user data.
13 vulnerabilities with 11 CVEs found in llama.cpp and Ollama, with ~151,000 unauthenticated servers exposed globally.
Five new AD CS escalation primitives (ESC18-22) abuse certificate policies and Authentication Mechanism Assurance.
CISA adds SonicWall SSL VPN MFA bypass (CVE-2026-19868) to KEV catalog, mandating federal patching by November 20.
DeepSeek V4.1 Flash reaches 72.8% on Vals CyberOffense benchmark at $3/run, nearing GPT-6’s 80.8% at $22.
ChatGPT Sandbox Escape Demonstrated at DEF CON
Researcher Simcha Kosman presented at DEF CON 34 showing that ChatGPT’s scheduled-task sandbox has internet access, unlike the local chat sandbox, creating a path for data exfiltration. The attack chain starts with indirect prompt injection via a ‘q parameter’ in the ChatGPT URL (chatgpt.com/?q=prompt), demonstrated on Android and Windows emulators. Prior research from Gen Zenity and Rod Rare established that file uploads and Gmail connectors enable indirect prompt injection.
Kosman demonstrated that a prompt to ‘create a task in one minute to get the sandbox public IP’ returned a public IP address, proving internet connectivity. An attempt to exfiltrate user info was initially blocked by the LLM with the response: ‘I can’t transmit private tool-driven location time or data to external server.’ The researcher mapped sandbox components, bypassed guardrails, and moved sensitive data into the scheduled-task sandbox for exfiltration. The research was conducted within 96 hours before the DEF CON talk submission deadline.
Why it matters: For IT professionals, this demonstrates a critical sandbox escape in a widely deployed AI service that could allow cross-user data theft via scheduled-task sandboxes with internet access, requiring immediate mitigation of prompt-injection vectors. For everyday people, it means private conversations and data shared with ChatGPT could potentially be accessed by attackers who craft malicious links or prompts.
Vladimir Tokarev and Ofat Itach from Sierra disclosed 13 vulnerabilities with 11 CVEs in llama.cpp and Ollama at DEF CON 34. llama.cpp has nearly 180,000 GitHub stars and 20,000 forks, while approximately 151,000 unauthenticated llama.cpp and Ollama servers are exposed globally. These C++ runtimes with manual memory management create attack surfaces via JNI on Android, HTTP servers, and Go bindings with unsafe APIs.
Attackers can supply malicious GGUF model files to exploit parsing logic. Three highlighted vulnerabilities include a use-after-free race condition in Android JNI with a full exploit, a use-after-free in the llama.cpp server allowing memory reclaim under user control but lacking remote ACL bypass, and an out-of-bounds vulnerability in Ollama. The research used manual source code review, sanitizer builds, and debuggers. A llama.cpp heap leak was also exploited.
Why it matters: These vulnerabilities in widely deployed local AI runtimes (llama.cpp and Ollama) allow remote attackers to potentially execute code or leak memory via unauthenticated servers and malicious model files, requiring IT professionals to urgently patch and secure inference endpoints, while everyday users risk compromise of local AI applications on devices like Android phones.
Daniel Monzon and Eric Labrador presented ‘Certified Re-Pwned Escalating All the Way Up’ at DEF CON 34, introducing five new AD CS escalation techniques named ESC 18 through ESC 22. AD CS (Active Directory Certificate Services) is a Microsoft-owned service enabling PKI features within Active Directory. The first technique, ESC 18 (‘CA CSR pass through AMA’), abuses the built-in Authentication Mechanism Assurance (AMA) feature present since Windows Server 2008.
ESC 18 requires the ENROLLEE_SUPPLIES_SUBJECT (ESS) bit mask enabled on the target certificate template and the CA server registry key ‘EnrollEnableEnrollRequestExtensionList’ to include ‘Certificate Policies’ (included by default). It is similar to ESC 13 and ESC 15 but uses certificate policies instead of issuance or application policies. The presentation includes defense and mitigation guidance for each technique for blue team implementation.
Why it matters: IT professionals must understand these new AD CS escalation primitives (ESC18-22) to patch misconfigurations and prevent privilege escalation attacks that could compromise entire Active Directory environments. Everyday people are affected because breaches of enterprise identity systems can lead to data theft, ransomware, and disruption of critical services they rely on.
CVE-2026-19868 allows attackers with valid credentials for an alternate authentication method to bypass SAML authentication controls, including SAML-enforced MFA. The flaw affects the SSL VPN component of SonicOS and is one of seven vulnerabilities described in an advisory published November 6. SonicWall’s description states: ‘An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).’
The vendor says an SSL VPN is exposed only if SAML-based login is enabled. CVE-2026-19868 has a CVSS score of 7.1 and was reported by Ryan Harris of The Electronic Office. SonicWall investigated a report indicating potential exploitation. CISA added the CVE to its Known Exploited Vulnerabilities catalog on November 6, and under Binding Operational Directive 26-04, federal agencies must remediate by November 20. Impacted devices include Gen7 and Gen8 firewalls with specific SonicOS versions; versions 7.3.4-7013 and 8.2.3-8015 resolve the issue with no workarounds. Two other flaws have CVSS 8.8 affecting the management interface, three are pre-authentication buffer overflows, and one is a weak password hashing issue.
Why it matters: IT professionals must urgently patch SonicOS firewalls because CISA confirms active exploitation and mandates federal agencies to remediate by November 20 with no workarounds available. Everyday people are affected because VPN bypasses can expose personal and corporate data accessed via remote connections.
Open-Weight Model DeepSeek V4.1 Flash Nears GPT-6 in Cyber Benchmark
The Vals CyberOffense benchmark simulates realistic corporate networks where AI agents operate solo from a public web address with zero human help. GPT-6 Sol, part of OpenAI’s restricted Daybreak cyber program, scored 80.8% of objectives. DeepSeek V4.1 Flash 1017, a freely available open-weight model, achieved 72.8% at about $3 per run versus roughly $22 for GPT-6. Once model weights are public, no provider can control or restrict usage.
In the harder Lighthouse test, Daybreak completed 27 of 31 objectives in under three hours, taking admin control, stealing passwords, and pivoting to a second company. DeepSeek managed 21 objectives at a tenth of the cost and wasn’t limited solely by safety guardrails. Longer runtimes were critical: DeepSeek scored zero in its first 25 million tokens and made most progress after 100 million tokens, meaning short tests underestimate open models’ potential. Vals notes the same models can help defenders find and fix vulnerabilities first. The gap between open and closed frontier models in cyber capabilities has shrunk to four to seven months, down from six to ten months for most of 2025. Open models are also much cheaper: DeepSeek V4-Pro costs $1.19 per cyber-range run versus $85 for Anthropic’s Opus 4.5. Safety measures on open models proved largely ineffective, and a recent Anthropic study showed GLM-5-3 can build exploits nearly at the level of internal top model Mythos.
Why it matters: For IT professionals, open-weight models like DeepSeek V4.1 Flash are approaching closed-model performance in cyber offense at a fraction of the cost, forcing a reevaluation of defensive tooling and red-team practices. For everyday people, the narrowing gap means AI-driven cyberattacks could become more frequent and sophisticated, increasing risks to personal data and online services.
NVIDIA Cosmos Turns World Models into Video Intelligence
NVIDIA Cosmos is a world foundation model that unlocks general-purpose video understanding. Turning this capability into a reliable, industry-ready solution requires domain-specific data, fine-tuning, and rigorous evaluation. NVIDIA and Milestone Systems collaborated in a livestream demonstrating how Cosmos combined with domain-specific data and evaluation pipelines enables specialized AI for real-world challenges.
The Accidents VLM, fine-tuned from NVIDIA Cosmos, shows measurable performance improvements across complex traffic scenarios. Real-world data and synthetic augmentation help handle rare events and edge cases. Domain-specific fine-tuning and evaluation pipelines improve model robustness and generalization. A Port of Antwerp-Bruges case study demonstrates AI spotting oil spills using this technology. NVIDIA Cosmos source code is available on GitHub at github.com/nvidia/Cosmos, and the Metropolis VSS Blueprint for video search and summarization is at github.com/NVIDIA-AI-Blueprints/video-search-and-summarization.
Why it matters: For IT professionals, NVIDIA Cosmos provides a foundation model framework that accelerates development of production-ready video AI through domain-specific fine-tuning and evaluation pipelines, reducing time-to-deployment for complex vision tasks. For everyday people, this technology enables safer transportation systems, environmental monitoring like oil spill detection, and smarter infrastructure that can understand and respond to real-world video data.
Siemens Uses NVIDIA Blueprint to Plan Production in Minutes
At the Erlangen electronics factory, Siemens and NVIDIA are pioneering adaptive, AI-powered manufacturing with agents and digital twins to accelerate production planning for high product variation. Previously, every new product variant required a physical prototype to train inspection models for quality control. Now, Siemens Process Preparation X agents use NVIDIA Cosmos to generate virtual prototypes and synthetic data sets to train and validate models before production starts, cutting time to market by 40%.
When components change unexpectedly, a simple agent prompt adapts inspection models with in-context learning in minutes. For new orders, agents in Intelligence Center X for Operations, built with the NVIDIA Factory Operations Blueprint, recommend production plans balancing orders, supplies, and line setups in minutes with potential cost savings of 20%. Digital Twin Composer with NVIDIA Omniverse Libraries combines physics-based simulation and real-time data to validate plans.
Why it matters: For IT professionals, this showcases how NVIDIA’s AI blueprints and Omniverse enable rapid deployment of digital twins and agent-based automation, reducing production planning from hours to minutes. For everyday people, it means faster product availability, potential cost reductions, and more resilient manufacturing that can quickly adapt to supply chain changes.
Passkey Attack Surface: 5 Billion Passkeys But Ceremony-Only Rare
Matteo Giordano presented ‘Beyond the Ceremony – The 2026 Passkey Attack Surface’ at DEF CON 34. A passkey originates inside an authenticator with a private key kept on the authenticator and a public key sent to the relying party, mediated by the client (often a browser). Passkeys are human-first technology; users want them synced to a trusted cloud provider, shared with co-workers or partners, and expect painless recovery. The ecosystem involves many independent players including browser vendors, hardware vendors, and cloud providers.
Passkey adoption grew from almost 1 billion in 2025 to almost 5 billion in 2026. As of the talk, 68% of organizations deploy passkeys for workforce authentication per the FIDO Alliance report. However, only 30% use passkeys as their primary authentication method, and less than 60% still rely on another phishable method; passkeys are almost never used alone. The FIDO Alliance states passkeys are not broken but the conversation about them often is; most recent research compromises the environment around passkeys, not the protocol or cryptography. The cryptographic ceremonies are assumed sound due to years of formal analysis; most attacks hit the surrounding ecosystem. Giordano designed an attack surface map with six microcategories: actors (client, server/relying party), links (connections), and facts (e.g., syncing to cloud), each bringing its own trust assumptions.
Why it matters: For IT professionals, the talk reveals that despite strong cryptography, the real passkey attack surface lies in the surrounding ecosystem—sync, recovery, client, and server components—where most compromises occur. For everyday people, with nearly 5 billion passkeys deployed but rarely used alone, account security depends on the weakest link in the chain, not just the passkey itself.
KARR Aftermarket Anti-Theft System Exposes 1M+ Cars
Car dealers predominantly in the Southwestern U.S. have been pre-installing ‘KARR,’ an aftermarket anti-theft alarm system, in every car they sell. They offer these systems as an upgrade with smartphone-based control over locks and immobilizer; if declined, the dealer says they will deactivate the system. This security system is authenticated by a global shared key, so anyone who recovers that key can remotely control nearby KARR units with a smartphone.
KARR is installed in an estimated 1.4 million cars, and every vulnerable unit shipped with the same authentication key. An attacker with a smartphone can unlock doors, disable the alarm and immobilizer, and trigger the horn and lights. The core impact is unauthorized access, enabling burglary, OBD-II access, and escalation including the key-programmer workflow. Every owner with KARR installed needs to update, including those who declined the upsell or inherited it used. The same recipe revealed vulnerabilities in other aftermarket BLE systems.
Why it matters: IT professionals must address fundamental BLE authentication flaws and supply-chain risks in aftermarket automotive systems that affect millions of vehicles. Everyday people face unauthorized vehicle access, theft, and privacy violations even if they declined the dealer upsell or bought a used car with KARR pre-installed.
Runpod — Runpod provides on-demand and serverless GPU infrastructure for training, fine-tuning, and deploying open-weight models like DeepSeek V4.1 Flash. Try Runpod’s serverless GPUs to fine-tune or deploy open-weight models without managing infrastructure. Try Runpod
NVIDIA Jetson Orin Nano on Amazon — Developers exploring world models for video intelligence can prototype on NVIDIA Jetson edge AI platforms. See current options and reviews on Amazon. View on Amazon
Affiliate disclosure: some links in this description are affiliate links. If you sign up through them, SysArticles may earn a commission at no extra cost to you. We only mention tools that are relevant to the story. As an Amazon Associate I earn from qualifying purchases.
Today’s briefing underscores how AI, identity, and embedded systems are converging as attack surfaces—patch, monitor, and assume breach.
This briefing is produced with AI assistance from the linked primary sources. Narration uses a synthetic AI news-anchor voice, built with Higgs Materials licensed from Boson AI USA, Inc.
Ali YAZICI is a Senior IT Infrastructure Manager with 15+ years of enterprise experience. While a recognized expert in datacenter architecture, multi-cloud environments, storage, and advanced data protection and Commvault automation , his current focus is on next-generation datacenter technologies, including NVIDIA GPU architecture, high-performance server virtualization, and implementing AI-driven tools. He shares his practical, hands-on experience and combination of his personal field notes and “Expert-Driven AI.” he use AI tools as an assistant to structure drafts, which he then heavily edit, fact-check, and infuse with my own practical experience, original screenshots , and “in-the-trenches” insights that only a human expert can provide.
